Reputation: 23

Check the bitness of an application binary on Windows (C/C++)

Is it possible to check the bitness of a binary (EXE) without/before running it? This could be easily done on Linux but I'm not familiar with Windows binary format.

Thanks.

Upvotes: 2

Answers (4)

Morpfh

Reputation: 4093

Read header:

IMAGE_FILE_HEADER structure

As a start you could do something like this, (should work for both dll and exe):
(Only tested on a few files – and those gave OK result.)

#include <stdio.h>
#include <stdlib.h>
#include <time.h>

/* Runtime Byteorder detection - Motorola or Intel (Does not catch mixed) */
static int byteorder_mm(void)
{
    union {double d; unsigned int i[2];} u;

    u.d = 1.0;

    return (u.i[0] != 0);
}

/* Char to unsigned int */
static unsigned int chr_to_ui(unsigned char *buf, int mm)
{
    if (mm)
        return buf[0] << 24 | buf[1] << 16 | buf[2] << 8 | buf[3];
    return buf[3] << 24 | buf[2] << 16 | buf[1] << 8 | buf[0];

}

/* Char to unsigned short */
static unsigned short chr_to_us(unsigned char *buf, int mm)
{
    if (mm)
        return buf[0] << 8 | buf[1];
    return buf[1] << 8 | buf[0];
}

int main(int argc, char *argv[])
{
    FILE *fh;
    unsigned char buf[128] = {0};
    char tmpstr[64];
    unsigned int tmp_ui;
    unsigned short tmp_us;

    time_t tt;

    int mm = byteorder_mm();

    if (argc < 2) {
        fprintf(stderr,
            "Missing input file.\n");
        return 1;
    }

    if ((fh = fopen(argv[1], "rb")) == NULL) {
        fprintf(stderr,
            "Unable to open %s.\n",
            argv[1]);
        perror(0);
        return 1;
    }

    /* Read MS-DOS Segment  */
    if (!fread(buf, 64, 1, fh)) {
        fprintf(stderr,
            "Unable to read %d bytes, @%ld.\n",
            2, ftell(fh));
        perror(0);
        fclose(fh);
        return 1;
    }

    /* Check header mark : MZ */
    if (buf[0] != 0x4d || buf[1] != 0x5a) {
        fprintf(stderr,
            "%s is missing Mark Zbikowski header.\n",
            argv[1]);
        fclose(fh);
        return 2;
    }

    /* Get offset (from 0) to IMAGE_NT_HEADERS */
    tmp_ui = chr_to_ui(buf+60, mm);

    fseek(fh, tmp_ui - 64, SEEK_CUR);

    /* Read IMAGE_NT_HEADER signature  */
    if (!fread(buf, 4, 1, fh)) {
        fprintf(stderr,
            "Unable to read %d bytes, @%ld.\n",
            4, ftell(fh));
        perror(0);
        fclose(fh);
        return 1;
    }

    /* Check signature : PE'x0'x0 */
    if (buf[0] != 0x50 || buf[1] != 0x45 ||
        buf[2] != 0x00 || buf[3] != 0x00) {
        fprintf(stderr,
            "%s is missing valid Portable Executable signature.\n",
            argv[1]);
        fclose(fh);
        return 2;
    }


    /* Read IMAGE_FILE_HEADER:
    typedef struct _IMAGE_FILE_HEADER {
        WORD  Machine;
        WORD  NumberOfSections;
        DWORD TimeDateStamp;
        DWORD PointerToSymbolTable;
        DWORD NumberOfSymbols;
        WORD  SizeOfOptionalHeader;
        WORD  Characteristics;
    } IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;
    */
    if (!fread(buf, 20, 1, fh)) {
        fprintf(stderr,
            "Unable to read %d bytes, @%ld.\n",
            4, ftell(fh));
        perror(0);
        fclose(fh);
        return 1;
    }

    /* Bittype */
    tmp_us = chr_to_us(buf, mm);

    switch (tmp_us) {
    case 0x014c: fprintf(stdout, "Machine: x86 (I386)\n"); break;
    case 0x0200: fprintf(stdout, "Machine: IA64 (Intel Itanium)\n"); break;
    case 0x8664: fprintf(stdout, "Machine: x64 (AMD64)\n"); break;
    default: fprintf(stderr,
            "Unable to recognize machine type 0x%04x\n",
            tmp_us);
        fclose(fh);
        return 2;
    }

    /* Timestamp */
    tmp_ui = chr_to_ui(buf+4, mm);

    tt = tmp_ui;
    strftime(tmpstr, 31, "%a %Y-%m-%d %H:%M:%S", localtime(&tt));
    fprintf(stdout,
        "Time   : %s (%d)\n",
        tmpstr, tmp_ui);

    /* ... */

    fclose(fh);
    return 0;
}

Upvotes: 0

Lumi

Reputation: 15274

Since you labeled this question C, there's a Win32 API function GetBinaryType. It doesn't work for DLLs, though.

if ( GetBinaryType(argv[i], &bintype) ) {
  switch(bintype) {
    case SCS_32BIT_BINARY: typename = TEXT("Windows 32 Bit"); break;
    case SCS_64BIT_BINARY: typename = TEXT("Windows 64 Bit"); break;
    case SCS_DOS_BINARY:   typename = TEXT("DOS-Programm");   break;
    case SCS_OS216_BINARY: typename = TEXT("OS/2-Programm");  break;
    case SCS_PIF_BINARY:   typename = TEXT("PIF-Datei");      break;
    case SCS_POSIX_BINARY: typename = TEXT("POSIX-Programm"); break;
    case SCS_WOW_BINARY:   typename = TEXT("Windows 16 Bit"); break;
    default:               typename = TEXT("unknown");        break;
  }
}
else {
  typename = TEXT("not executable");
}

Upvotes: 1